CVE-2026-115917: vLLM: wildcard CORS lets web pages reach local servers

vLLM's OpenAI-compatible server ships with a wildcard CORS policy before 0.32.0, so a malicious web page can use a victim's browser as a bridge to an unauthenticated vLLM instance on localhost, an internal network, or a VPN. The attacker can call /v1/models and /v1/chat/completions, burn GPU cycles and read the responses. Severity is low (CVSS 3.4) because it needs user interaction, high attack complexity, and the target must have no authentication. There is no known public exploit, no Nuclei template, no KEV listing and no EPSS data, although vLLM has 94 downstream dependents and a package risk score of 61/100. Upgrade to vLLM 0.32.0 or later, and in the meantime restrict allowed origins, enable API key authentication and keep inference endpoints off flat internal networks.

No confirmed active exploitation of CVE-2026-115917 has been reported, but organizations should still patch proactively.

1) Upgrade vLLM to 0.32.0 or later (fix in PR 61009, commit fcae5c9). 2) Until patched, set the server's allowed-origins option to explicit trusted origins instead of the wildcard. 3) Enable API key or bearer authentication on all vLLM servers, including internal ones. 4) Place inference endpoints behind an authenticated reverse proxy and segment them from user workstation networks. 5) Detect abuse by reviewing access logs for requests carrying unexpected Origin headers and for unusual spikes in chat completion calls or GPU utilization. 6) Inventory pip installations of vllm to identify versions below 0.32.0.

This vulnerability affects the following AI/ML architecture patterns: model serving, LLM inference endpoints, internal AI platforms, developer workstations running local inference.

CVE-2026-115917 has a CVSS v3.1 base score of 3.4 (LOW). The EPSS exploitation probability is 0.24%.